In an IT (Information Technology) system, a manager monitors the system, and avoids a fatal situation such as a system shutdown, by prioritizing detected abnormalities, when occurrence of a system abnormality is recognized.
Patent literatures 1 and 2 describe examples of operation management systems detecting the abnormality of the IT system. The operation management systems described in patent literatures 1 and 2 detect a correlation with respect to each of combinations of metrics, on the basis of a measurement value of a plurality of the metrics (performance indexes) of the system, and generate a correlation model. The operation management systems determine whether correlation destruction has occurred or not with respect to an inputted measurement value of the metrics using the generated correlation model to detect a system abnormality.
In the operation management system, a graph showing the number of correlation destructions with time, which is used by a manager to determine whether a system abnormality has occurred, is outputted. A list of the metrics in which the abnormality is detected (abnormal metrics) is also outputted with an abnormality score, as details of the abnormality at a given time.
As a related technology, patent literature 3 discloses a monitoring device which detects a monitoring item and a threshold value from resource items of a system by using a statistics technique.